GHSA-j6wp-3859-vxfg

Source

https://github.com/advisories/GHSA-j6wp-3859-vxfg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-j6wp-3859-vxfg/GHSA-j6wp-3859-vxfg.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-j6wp-3859-vxfg

Aliases

Published

2021-11-10T16:52:24Z

Modified

2023-11-01T04:56:29.343354Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

OIDC claims not updated from Identity Provider in Pomerium

Details

Impact

Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowed_idp_claims as part of policy. If using allowed_idp_claims and a user's claims are changed, Pomerium can make incorrect authorization decisions.

Patches

v0.15.6

Workarounds

Clear data on databroker service by clearing redis or restarting the in-memory databroker to force claims to be updated

References

https://github.com/pomerium/pomerium/pull/2724

For more information

If you have any questions or comments about this advisory: * Open an issue in Pomerium * Email us at security@pomerium.com

Database specific

{
    "nvd_published_at": "2021-11-05T23:15:00Z",
    "github_reviewed_at": "2021-11-08T21:37:07Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-863"
    ]
}

References

Affected packages

Go / github.com/pomerium/pomerium

Package

Name: github.com/pomerium/pomerium; View open source insights on deps.dev
Purl: pkg:golang/github.com/pomerium/pomerium

Affected ranges

Type: SEMVER
Events: Introduced

0.14.0

Fixed

0.15.6